Skip to main content

Log Search

Log Search allows you to query and analyze log data sent to Sumo Logic. There are many features to help you use our robust Search Query Language, such as LogCompare, LogReduce, LogExplain, Lookup Tables, Subqueries, and Time Compare. See Get Started with Search to begin exploring your data in Sumo Logic.

Guides

In this section, we'll introduce the following concepts:

icon

Getting started with Log Search

Start here to begin exploring your data in Sumo Logic.

icon

Search Query Language

The extensive Sumo Logic query options help you gain valuable insight into your log messages.

icon

Search Cheat Sheets

Cheat sheets provide examples of useful search queries for different use cases.

icon

LogReduce

Quickly assess activity patterns for things like a range of devices or traffic on a website.

icon

LogCompare

Easily compare log data from different time periods to detect major changes or anomalies.

icon

Lookup Tables

Learn about Lookup tables and the search operators you can use with them.

icon

Live Tail

Real-time live feed of log events associated with a Source or Collector.

icon

Behavior Insights

Gain behavioral insight of your environment using LogReduce operators.

icon

Subqueries

Filter and evaluate conditions for a query when you may not be sure of the exact filter.


note

To interact with other Sumo Logic users, post feedback, or ask a question, visit the Sumo Logic Community Search & Query Forum.

Journey of a log

In this micro lesson, learn about the ingestion pipeline and the journey that a log message takes from collection into the Sumo Logic platform. The video covers key considerations for administrators around the ingestion pipeline and demonstrates how this process translates into a search, turning a raw event into a schema and then into actionable insights.

Partitions and Views

Logs collected by Sumo Logic are indexed in Partitions and Scheduled Views. In addition, there are internal indexes such as Health Events, Archive, Audit, and Volume indexes.

Data Tiers

Data Tiers provide the ability to allocate data to different storage tiers based on the frequency of access: Continuous, Frequent, and Infrequent.

To search specific Data Tiers. See Searching Data Tiers.

Traces

Traces are collected with SumoLogic Kubernetes Collection or a standalone OpenTelemetry collector through an HTTP Traces Source.

Status
Legal
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.